Port-forwarding agent

Port forwarding lets you reach a TCP port on a deployed device, such as SSH or a local web interface, from your workstation. This page shows you how to enable the agent on the device and open a forwarding session with the fun CLI.

How it works

The agent on the device keeps using the device's existing MQTTS connection. When you open a session, traffic between your local port and the device port travels over that connection. You don't open any inbound port on the device or its network.

You can run the agent in two ways:

Option	Use it when
Built into the Linux daemon	The device already runs the daemon. Since daemon 1.8, this also supports the remote terminal.
Standalone `fundamentum-edge-pfwd`	You only need port forwarding, without the daemon.

Before you begin

The device is provisioned. See Provisioning.
The service you want to reach listens on the device, for example SSH on port 22.
The fun CLI is installed and signed in on your workstation, with access to the device's project.

1. Enable the agent on the device

Option A: in the Linux daemon

Port forwarding is off by default. Turn it on in config.toml:

[pfwd]
enabled = true

Or start the daemon with --pfwd:

fundamentum-edge --pfwd

Option B: standalone agent

Install the standalone agent from crates.io:

cargo install fundamentum-edge-pfwd

Run it with the device identity and its private key:

fundamentum-edge-pfwd \
  --private-key ./rsa_private.pem \
  --project-id <project-id> \
  --region-id 1 \
  --registry-id <registry-id> \
  --serial <serial-number> \
  --endpoint mqtts.fundamentum-iot.com

Option	Default	Description
`--private-key`	`./rsa_private.pem`	Device private key
`--project-id`, `--region-id`, `--registry-id`, `--serial`	None	Device identity
`--endpoint`	`localhost`	MQTT broker host; set it to `mqtts.fundamentum-iot.com`

If you need a key pair, generate it as shown in Self-provisioning.

2. Open a session from your workstation

Forward a device port to a local port:

fun devices port-forward --project <project-id> --registry <registry-id> --serial <serial-number> \
  --remote-port 22 --local-port 2222

Flag	Description
`-p`, `--project`	Project ID
`-r`, `--registry`	Registry ID
`-s`, `--serial`	Device serial number
`-d`, `--remote-port`	Port on the device; it must be listening
`-l`, `--local-port`	Port on your workstation

The short alias is fun devices pf. Use --context <name> to pick another CLI context (default: default).

3. Use the forwarded port

While the session is open, connect to the local port as if it were the device:

ssh -p 2222 <device-user>@localhost

Press any key in the fun terminal to close the session.

What's next

Remote terminal and port forwarding for the operator's side.
The fun CLI.